[roomote-roomote]

​Created by Roomote. View the session or mention @roomote-roomote for follow-up asks.

Related issue

Addresses all six Better Auth Dependabot alerts: #310, #311, #312, #313, #314, and #315: one critical, two high, three low. No alerts were dismissed. They remain open on the default branch until merge and GitHub dependency rescan; the proposed graph contains no vulnerable targeted resolutions.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

Patch the cohesive authentication bundle while preserving deployed provider callbacks, existing linked identities, sign-in and explicit account linking. The authentication attempt documented in PR #3628 identified real 1.7 migration requirements; this PR implements those requirements. It does not include the parser, Hono, or broad schema/dependency remediation in the other open PRs.

What changed

• Align Better Auth, core, adapters and telemetry 1.6.22 → 1.7.12. The minimum patched 1.7.7 attempt introduced an auth-utils peer mismatch; 1.7.12 includes the upstream peer-alignment fix. Required auth dependencies also move to utils 0.5.0, better-fetch 1.3.2, better-call 1.4.4 and rou3 0.9.2.
• Migrate browser sign-in, setup, linked-account and Teams callers to the supported social endpoints. Remove the deleted generic OAuth client plugin. Keep all existing registered /api/auth/oauth2/callback/:id URLs for authorization and code exchange, resolving the host per request; internally dispatch GET and form POST callbacks to core.
• Preserve Slack's scopes and fresh per-request nonce. Use Microsoft's multi-tenant built-in provider with the existing microsoft-entra-id provider ID and sub account identity. Retain GUID/common/organizations/consumers tenants, OIDC userinfo name/email/preferred-username behavior and offline access. Explicitly verify the ID token with upstream signature, issuer, audience, expiry and tenant checks, and bind its nonce and userinfo subject to the flow.
• Preserve explicit linking when a provider returns unverified or placeholder emails. A session-authorized, server-only OAuth-state marker gates provider trust; unverified profiles cannot implicitly attach themselves to an existing user by email. Returning users can still sign in by their existing provider identity. Core retains its ownership-conflict checks; profiles are not relabeled as verified.
• Raise only the two auth-scoped Zod override floors to ^4.5.0 (resolution 4.6.7). Keeping the former override resolved 4.4.3 and failed actual auth initialization with z.validate is not a function. The workspace Zod 3 pin and unrelated schema work remain untouched. Lockfile generated by pnpm, retaining compatible existing transitive resolutions rather than broadly refreshing dependencies.

No intended user-facing workflow or database-schema change. Upstream 1.7.7 security notes describe purpose-separated OAuth/Magic Link state and PostgreSQL rate-limit fixes; the changelog covers the migration and later compatibility fixes. Roll out participating auth servers together and restart sign-ins/account-linking flows begun before the upgrade; existing database sessions are retained.

How it was tested

• Full workspace forced frozen install passed. Registry publication-time checks cover every new resolution (13 total), each older than seven days. The aligned 1.7.12 family was published October 20. minimumReleaseAge: 10080 and all exclusions are byte-for-byte unchanged. Every installed release-family package has a single 1.7.12 resolution, outside the six advisory ranges.
• Complete web server suites: 249 files / 2,284 tests passed. New 30-case real-library/PostgreSQL OAuth integration coverage exercises all six providers' initiation and explicit linking, preview callback continuity, code-exchange redirect continuity, Slack nonce freshness and GET/POST callbacks, Microsoft returning-account identity, tenant classes, profile fallback and new sign-up, plus invalid ordinary token fixtures and unverified implicit-link refusal. Only provider HTTP responses and deployment policy/config boundaries are fixtures; Better Auth, adapters, state handling, sessions and database writes are real. Existing session integration tests cover renewal, expiry, revocation and logout. An additional invariant test keeps explicit-link provider trust limited to callback requests, excluding direct-token sign-in and linking endpoints.
• Targeted client suites: 4 files / 49 tests passed, including real upgraded client endpoint dispatch and sign-in/setup UI regressions. Web and API production builds passed. Broad fast lint/typechecks, Knip and unmodified commit/push hooks passed. Full repository tests and the entire client suite were not run; the full affected server surface and focused auth clients were selected. Existing build tracing/deprecation warnings and the Dayton/AWS peer warning remain non-blocking.
• Browser smoke: real sign-in form and protected settings render with the installed library. The authenticated screenshot uses the environment's development session-seeding route; screenshots do not prove credential submission or external-provider OAuth. The backend-only callback trust restriction and its invariant test were added after capture and do not alter rendering. No live provider credentials or external sign-in side effects were used; controlled-provider integration tests establish OAuth behavior.

Screenshots

Sign-in form rendering only:

Protected settings after development session seeding, not an OAuth login:

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
  • Normal broad fast equivalents passed; formatting-inclusive aliases were not run.
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset
  • No changeset for the behavior-preserving dependency security migration.

[roomote-community]

No new code issues found. Reviewed the explicit-link state marker, callback-path handling, Microsoft profile validation, and setup provider mapping against Better Auth 1.7.12. CI lint, type checks, and app build passed; tests were still running when checked. See session

_{Reviewed 3300494}